{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "> 原文地址 [linux.cn](https://linux.cn/article-8313-1.html?pr)\n",
    "\n",
    "将 [SSH 用户会话限制](http://www.tecmint.com/restrict-sftp-user-home-directories-using-chroot/) [1] 访问到特定的目录内，特别是在 web 服务器上，这样做有多个原因，但最显而易见的是为了系统安全。为了锁定 SSH 用户在某个目录，我们可以使用 **chroot** 机制。\n",
    "\n",
    "在诸如 Linux 之类的类 Unix 系统中更改 root（**chroot**）是将特定用户操作与其他 Linux 系统分离的一种手段；使用称为 **chrooted 监狱** 的新根目录更改当前运行的用户进程及其子进程的明显根目录。\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215326aucr7zqjr0j7cuqs.jpg)\n",
    "\n",
    "在本教程中，我们将向你展示如何限制 SSH 用户访问 Linux 中指定的目录。注意，我们将以 root 用户身份运行所有命令，如果你以普通用户身份登录服务器，请使用 [sudo 命令](https://linux.cn/tag-sudo.html) [2]。\n",
    "\n",
    "### 步骤 1：创建 SSH chroot 监狱\n",
    "\n",
    "1、 使用 mkdir 命令开始创建 chroot 监狱：\n",
    "\n",
    "```\n",
    "# mkdir -p /home/test\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "2、 接下来，根据 `sshd_config` 手册找到所需的文件，`ChrootDirectory` 选项指定在身份验证后要 chroot 到的目录的路径名。该目录必须包含支持用户会话所必需的文件和目录。\n",
    "\n",
    "对于交互式会话，这需要至少一个 shell，通常为 `sh` 和基本的 `/dev` 节点，例如 `null`、`zero`、`stdin`、`stdout`、`stderr` 和 `tty` 设备：\n",
    "\n",
    "```\n",
    "# ls -l /dev/{null,zero,stdin,stdout,stderr,random,tty}\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215336gzm7nraoa21onam7.png)\n",
    "\n",
    "_列出所需文件_\n",
    "\n",
    "3、 现在，使用 `mknod` 命令创建 `/dev` 下的文件。在下面的命令中，`-m` 标志用来指定文件权限位，`c` 意思是字符文件，两个数字分别是文件指向的主要号和次要号。\n",
    "\n",
    "```\n",
    "# mkdir -p /home/test/dev/      \n",
    "# cd /home/test/dev/\n",
    "# mknod -m 666 null c 1 3\n",
    "# mknod -m 666 tty c 5 0\n",
    "# mknod -m 666 zero c 1 5\n",
    "# mknod -m 666 random c 1 8\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215338ide3pr3krvrosere.png)\n",
    "\n",
    "_创建 /dev 和所需文件_\n",
    "\n",
    "4、 在此之后，在 chroot 监狱中设置合适的权限。注意 chroot 监狱和它的子目录以及子文件必须被 `root` 用户所有，并且对普通用户或用户组不可写：\n",
    "\n",
    "```\n",
    "# chown root:root /home/test\n",
    "# chmod 0755 /home/test\n",
    "# ls -ld /home/test\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215339uvvvppvomvvfm2oi.png)\n",
    "\n",
    "_设置目录权限_\n",
    "\n",
    "### 步骤 2：为 SSH chroot 监狱设置交互式 shell\n",
    "\n",
    "5、 首先，创建 `bin` 目录并复制 `/bin/bash` 到 `bin` 中：\n",
    "\n",
    "```\n",
    "# mkdir -p /home/test/bin\n",
    "# cp -v /bin/bash /home/test/bin/\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215340daajm55eoacw5f4e.png)\n",
    "\n",
    "_复制文件到 bin 目录中_\n",
    "\n",
    "6、 现在，识别 bash 所需的共享库，如下所示复制它们到 `lib64` 中：\n",
    "\n",
    "```\n",
    "# ldd /bin/bash\n",
    "# mkdir -p /home/test/lib64\n",
    "# cp -v /lib64/{libtinfo.so.5,libdl.so.2,libc.so.6,ld-linux-x86-64.so.2} /home/test/lib64/\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215341z7r8471jmoz685w4.png)\n",
    "\n",
    "_复制共享库文件_\n",
    "\n",
    "### 步骤 3：创建并配置 SSH 用户\n",
    "\n",
    "7、 现在，使用 [useradd 命令](http://www.tecmint.com/add-users-in-linux/) [3] 创建 SSH 用户，并设置安全密码：\n",
    "\n",
    "```\n",
    "# useradd tecmint\n",
    "# passwd tecmint\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "8、 创建 chroot 监狱通用配置目录 `/home/test/etc` 并复制已更新的账号文件（`/etc/passwd` 和 `/etc/group`）到这个目录中：\n",
    "\n",
    "```\n",
    "# mkdir /home/test/etc\n",
    "# cp -vf /etc/{passwd,group} /home/test/etc/\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215342zo1eouy2nsvypzen.png)\n",
    "\n",
    "_复制密码文件_\n",
    "\n",
    "注意：每次向系统添加更多 SSH 用户时，都需要将更新的帐户文件复制到 `/home/test/etc` 目录中。\n",
    "\n",
    "### 步骤 4：配置 SSH 来使用 chroot 监狱\n",
    "\n",
    "9、 现在打开 `sshd_config` 文件。\n",
    "\n",
    "```\n",
    "# vi /etc/ssh/sshd_config\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "在此文件中添加或修改下面这些行。\n",
    "\n",
    "```\n",
    "# 定义要使用 chroot 监狱的用户\n",
    "Match User tecmint\n",
    "# 指定 chroot 监狱\n",
    "ChrootDirectory /home/test\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215343tz71v933d1wgzisv.png)\n",
    "\n",
    "_配置 SSH chroot 监狱_\n",
    "\n",
    "保存文件并退出，重启 sshd 服务：\n",
    "\n",
    "```\n",
    "# systemctl restart sshd\n",
    "或者\n",
    "# service sshd restart\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "### 步骤 5：测试 SSH 的 chroot 监狱\n",
    "\n",
    "10、 这次，测试 chroot 监狱的设置是否如希望的那样成功了：\n",
    "\n",
    "```\n",
    "# ssh tecmint@192.168.0.10\n",
    "-bash-4.1$ ls\n",
    "-bash-4.1$ date\n",
    "-bash-4.1$ uname\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215344qwrf1h8xuwc0k0sk.png)\n",
    "\n",
    "_测试 SSH 用户 chroot 监狱_\n",
    "\n",
    "从上面的截图上来看，我们可以看到 SSH 用户被锁定在了 chroot 监狱中，并且不能使用任何外部命令如（`ls`、`date`、`uname` 等等）。\n",
    "\n",
    "用户只可以执行 `bash` 以及它内置的命令（比如：`pwd`、`history`、`echo` 等等）：\n",
    "\n",
    "```\n",
    "# ssh tecmint@192.168.0.10\n",
    "-bash-4.1$ pwd\n",
    "-bash-4.1$ echo \"Tecmint - Fastest Growing Linux Site\"\n",
    "-bash-4.1$ history\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215345oabfcffyhkbt9byb.png)\n",
    "\n",
    "_SSH 内置命令_\n",
    "\n",
    "### 步骤 6： 创建用户的主目录并添加 Linux 命令\n",
    "\n",
    "11、 从前面的步骤中，我们可以看到用户被锁定在了 root 目录，我们可以为 SSH 用户创建一个主目录（以及为所有将来的用户这么做）：\n",
    "\n",
    "```\n",
    "# mkdir -p /home/test/home/tecmint\n",
    "# chown -R tecmint:tecmint /home/test/home/tecmint\n",
    "# chmod -R 0700 /home/test/home/tecmint\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215347twfkvvvikspj15ij.png)\n",
    "\n",
    "_创建 SSH 用户主目录_\n",
    "\n",
    "12、 接下来，在 `bin` 目录中安装几个用户命令，如 `ls`、`date`、`mkdir`：\n",
    "\n",
    "```\n",
    "# cp -v /bin/ls /home/test/bin/\n",
    "# cp -v /bin/date /home/test/bin/\n",
    "# cp -v /bin/mkdir /home/test/bin/\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215348lpem7e9fdxlf0el0.png)\n",
    "\n",
    "_向 SSH 用户添加命令_\n",
    "\n",
    "13、 接下来，检查上面命令的共享库并将它们移到 chroot 监狱的库目录中：\n",
    "\n",
    "```\n",
    "# ldd /bin/ls\n",
    "# cp -v /lib64/{libselinux.so.1,libcap.so.2,libacl.so.1,libc.so.6,libpcre.so.1,libdl.so.2,ld-linux-x86-64.so.2,libattr.so.1,libpthread.so.0} /home/test/lib64/\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215349xlml1e6yyh9f1v1i.png)\n",
    "\n",
    "_复制共享库_\n",
    "\n",
    "### 步骤 7：测试 sftp 的 用 chroot 监狱\n",
    "\n",
    "14、 最后用 sftp 做一个测试；测试你先前安装的命令是否可用。\n",
    "\n",
    "在 `/etc/ssh/sshd_config` 中添加下面的行：\n",
    "\n",
    "```\n",
    "# 启用 sftp 的 chroot 监狱 \n",
    "ForceCommand internal-sftp\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "保存并退出文件。接下来重启 sshd 服务：\n",
    "\n",
    "```\n",
    "# systemctl restart sshd\n",
    "或者\n",
    "# service sshd restart\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "15、 现在使用 ssh 测试，你会得到下面的错误：\n",
    "\n",
    "```\n",
    "# ssh tecmint@192.168.0.10\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215350fiu8i42xxii8r8kh.png)\n",
    "\n",
    "_测试 SSH Chroot 监狱_\n",
    "\n",
    "试下使用 sftp：\n",
    "\n",
    "```\n",
    "# sftp tecmint@192.168.0.10\n",
    "\n",
    "\n",
    "```\n",
    "\n",
    "![](https://img.linux.net.cn/data/attachment/album/201703/16/215350qhz5lh6x26fhfd77.png)\n",
    "\n",
    "_测试 sFTP SSH 用户_\n",
    "\n",
    "**建议阅读：** [使用 chroot 监狱将 sftp 用户限制在主目录中](http://www.tecmint.com/restrict-sftp-user-home-directories-using-chroot/) [4]。\n",
    "\n",
    "就是这样了！在文本中，我们向你展示了如何在 Linux 中限制 ssh 用户到指定的目录中（ chroot 监狱）。请在评论栏中给我们提供你的想法。\n",
    "\n",
    "作者简介：\n",
    "\n",
    "Aaron Kili 是一个 Linux 及 F.O.S.S 热衷者，即将成为 Linux 系统管理员、web 开发者，目前是 TecMint 的内容创作者，他喜欢用电脑工作，并坚信分享知识。\n",
    "\n",
    "via: [http://www.tecmint.com/restrict-ssh-user-to-directory-using-chrooted-jail/](http://www.tecmint.com/restrict-ssh-user-to-directory-using-chrooted-jail/)\n",
    "\n",
    "作者：[Aaron Kili](http://www.tecmint.com/author/aaronkili/)[5] 译者：[geekpi](https://github.com/geekpi)[6] 校对：[jasminepeng](https://github.com/jasminepeng)[7]\n",
    "\n",
    "[1]: http://www.tecmint.com/restrict-sftp-user-home-directories-using-chroot/  \n",
    "[2]: https://linux.cn/tag-sudo.html  \n",
    "[3]: http://www.tecmint.com/add-users-in-linux/  \n",
    "[4]: http://www.tecmint.com/restrict-sftp-user-home-directories-using-chroot/  \n",
    "[5]: http://www.tecmint.com/author/aaronkili/  \n",
    "[6]: https://github.com/geekpi  \n",
    "[7]: https://github.com/jasminepeng  \n",
    "[8]: https://github.com/LCTT/TranslateProject  \n",
    "[9]: https://linux.cn/article-8313-1.html?pr"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.7.3"
  },
  "toc": {
   "base_numbering": 1,
   "nav_menu": {},
   "number_sections": true,
   "sideBar": true,
   "skip_h1_title": false,
   "title_cell": "Table of Contents",
   "title_sidebar": "Contents",
   "toc_cell": false,
   "toc_position": {},
   "toc_section_display": true,
   "toc_window_display": false
  },
  "varInspector": {
   "cols": {
    "lenName": 16,
    "lenType": 16,
    "lenVar": 40
   },
   "kernels_config": {
    "python": {
     "delete_cmd_postfix": "",
     "delete_cmd_prefix": "del ",
     "library": "var_list.py",
     "varRefreshCmd": "print(var_dic_list())"
    },
    "r": {
     "delete_cmd_postfix": ") ",
     "delete_cmd_prefix": "rm(",
     "library": "var_list.r",
     "varRefreshCmd": "cat(var_dic_list()) "
    }
   },
   "types_to_exclude": [
    "module",
    "function",
    "builtin_function_or_method",
    "instance",
    "_Feature"
   ],
   "window_display": false
  }
 },
 "nbformat": 4,
 "nbformat_minor": 2
}
